redocly.com Website
56 global-ready
relative to the checks that apply to this site; global measures it against a maximally agent-ready site. Website https://redocly.com/.
Checks by category
-
C1
partial
Discoverability
4 / 6 checks pass
/robots.txt present SHOULD PASS
Goal: Publish robots.txt and state your crawl policy explicitly.
Result: Verified (https://redocly.com/robots.txt -> 200)
/sitemap.xml present MAY PASS
Goal: Publish sitemap.xml so agents can enumerate your content URLs.
Result: Verified (https://redocly.com/sitemap.xml -> 200)
Resources: sitemaps.org · Fix skill
Unknown paths return HTTP 404 or 410 SHOULD PASS
Goal: Return a real HTTP 404 or 410 for unknown paths instead of a 200 SPA shell.
Result: Verified (https://redocly.com/anc-web-audit-no-such-page -> 404)
Resources: RFC 9110 status codes · Fix skill
Homepage sends RFC 8288 Link headers pointing at agent resources SHOULD MISSING
Goal: Advertise machine surfaces in a Link response header on / for header-only discovery.
Result: Not found (https://redocly.com/ -> 200 (header link no match /rel="?(service-desc|describedby|api-catalog|service-doc)"?/))
Fix: Send a `Link` response header on `/` (RFC 8288) whose `rel` points at your machine surfaces, so an agent reading only response headers finds them without parsing HTML or probing `/.well-known`. Use the RFC 8631 service trio and the RFC 9727 catalog: `rel="service-desc"` at a machine-readable description (OpenAPI, or an MCP server card), `rel="service-doc"` at the human-readable doc, `rel="service-meta"` at the service-context declaration, and `rel="api-catalog"` at your `/.well-known/api-catalog` index. Example: `Link: </.well-known/api-catalog>; rel="api-catalog", </.well-known/mcp/server-card.json>; rel="service-desc"`.
Resources: RFC 8288 (Link) · RFC 8631 (service links) · RFC 9727 (api-catalog) · Fix skill
Root HTML links to machine surfaces via <link rel> SHOULD PASS
Goal: Point link rel elements at your machine surfaces from the root HTML head.
Result: Verified (https://redocly.com/ -> 200)
Resources: RFC 8631 (service-desc/doc) · Fix skill
DNS for AI Discovery (DNS-AID) records under _agents (IETF draft) MAY N/A
Goal: Publish DNSSEC-signed SVCB records under _agents for DNS-level agent discovery.
Result: Not implemented, optional (no DNS-AID records)
Resources: DNS-AID draft · Fix skill
404 body is markdown with a recovery link SHOULD MISSING
Goal: Serve a short markdown 404 that links at least one agent recovery surface.
Result: Not found (https://redocly.com/anc-web-audit-no-such-page -> 404 (content-type "text/html; charset=UTF-8" !~ /markdown|text/plain/))
Fix: When `Accept: text/markdown` hits an unknown path, return 404 or 410 with a short markdown body that includes at least one recovery link: sitemap, `llms.txt`, a docs index, or an equivalent same-origin href. Linking both sitemap and `llms.txt` as absolute URLs is the stronger pattern. Zero links is a miss even when the status is correct.
Resources: llmstxt.org · Fix skill
-
C2
partial
Content for agents
6 / 10 checks pass
/llms.txt present with a summary and link index SHOULD PASS
Goal: Serve /llms.txt with a title, summary, and categorized link index.
Result: Verified (https://redocly.com/llms.txt -> 200)
Resources: llmstxt.org · Fix skill
/llms-full.txt present (single-fetch full corpus) MAY N/A
Goal: Serve the whole docs corpus as markdown at /llms-full.txt for one-fetch ingestion.
Result: Not implemented, optional (https://redocly.com/llms-full.txt -> 404 (status 404 not in [200]))
Resources: llmstxt.org · Fix skill
Accept text/markdown content negotiation returns markdown SHOULD MISSING
Goal: Honor Accept text/markdown on content URLs with raw markdown, not HTML chrome.
Result: Not found (https://redocly.com/ -> 200 (content-type "text/html; charset=UTF-8" !~ /markdown|text/plain/))
Fix: Honor `Accept: text/markdown` on content URLs and return raw markdown rather than HTML chrome. Agents parse markdown far more reliably than a JS-rendered page. Serve the markdown twin at the same URL via content negotiation, invisibly to crawlers.
Resources: RFC 7763 (text/markdown) · Fix skill
Per-section llms-full.txt files resolve under content subdirectories MAY N/A
Goal: Serve a scoped llms-full.txt corpus inside each major content section.
Result: Not applicable (root llms-full.txt not present)
Resources: llmstxt.org · Fix skill
llms.txt has H1, summary, and a link index SHOULD PASS
Goal: Structure /llms.txt with an H1, a blockquote summary, and a markdown link index.
Result: Verified (https://redocly.com/llms.txt -> error)
Resources: llmstxt.org · Fix skill
llms.txt has a when-to-use or programmatic-access section SHOULD MISSING
Goal: Tell agents when to use the MCP or docs from a short llms.txt heading.
Result: Not found (https://redocly.com/llms.txt -> error (no when-to-use heading))
Fix: Add a heading such as `## When to use` or `## Programmatic access` with a few lines on when an agent should connect (for example: "Use the MCP when you need to search or score a CLI"). The audit looks for that heading; it does not grade the prose with an LLM.
Resources: llmstxt.org · Fix skill
Bare CLI User-Agent receives the markdown twin MAY N/A
Goal: Serve the markdown twin to shell HTTP clients that state no content-type preference.
Result: Not implemented, optional (https://redocly.com/ -> 200 (content-type "text/html; charset=UTF-8" !~ /markdown|text/plain/))
Resources: RFC 7763 (text/markdown) · RFC 9110 (User-Agent) · Fix skill
AI user-fetch User-Agent receives the markdown twin MAY N/A
Goal: Serve the markdown twin to AI on-demand user-fetchers that state no content-type preference.
Result: Not implemented, optional (https://redocly.com/ -> 200 (content-type "text/html; charset=UTF-8" !~ /markdown|text/plain/))
Resources: RFC 7763 (text/markdown) · OpenAI bots and User-Agents · Fix skill
Negotiated responses carry Vary Accept, User-Agent SHOULD MISSING
Goal: Emit Vary Accept, User-Agent so shared caches never serve one client the wrong variant.
Result: Not found (https://redocly.com/ -> 200 (header vary no match /(?=.*accept(?!-))(?=.*user-agent)/))
Fix: When the same URL serves HTML or markdown depending on the request, emit `Vary: Accept, User-Agent` on every response. Without it a shared cache (a CDN or a corporate proxy) can store the markdown twin under the bare URL and then hand it to a browser, or vice versa. Listing both request headers you negotiate on tells every cache to key its stored copies by them, so each client class gets the variant it asked for. If the CDN ignores or strips Vary (Cloudflare's zone cache historically keeps only `Accept-Encoding`), do not give that cache a long `s-maxage` on negotiated responses — otherwise HIT replies reach clients with no Vary and the check still fails.
Resources: RFC 9110 (Vary) · Fix skill
Accept text/plain returns the markdown twin MAY N/A
Goal: Treat Accept text/plain as a request for the raw markdown source.
Result: Not implemented, optional (https://redocly.com/ -> 200 (content-type "text/html; charset=UTF-8" !~ /markdown|text/plain/))
Resources: RFC 7763 (text/markdown) · Fix skill
Root HTML has a descriptive <meta name="description"> SHOULD PASS
Goal: Add a meta description naming what the service does and its agent entry points.
Result: Verified (https://redocly.com/ -> 200)
Resources: MDN meta description · Fix skill
Root HTML embeds Schema.org JSON-LD MAY N/A
Goal: Embed Schema.org JSON-LD so agents get typed facts without inference.
Result: Not implemented, optional (https://redocly.com/ -> 200 (body no match /application/ld\+json/))
Resources: Schema.org · Fix skill
Markdown twin carries YAML frontmatter MAY N/A
Goal: Prefix the markdown twin with a YAML frontmatter block so agents read page metadata without parsing the body.
Result: Not implemented, optional (https://redocly.com/ -> 200 (root served HTML, not a markdown twin))
Resources: YAML front matter (Jekyll) · RFC 7763 (text/markdown) · Fix skill
Root HTML uses semantic landmarks MAY PASS
Goal: Use semantic landmarks so the HTML path is parseable structure, not div soup.
Result: Verified (https://redocly.com/ -> 200)
Resources: MDN content sectioning · Fix skill
Root HTML has a <noscript> with machine entry points SHOULD PASS
Goal: Give non-JS agents a noscript block listing your machine entry points.
Result: Verified (https://redocly.com/ -> 200)
Resources: MDN noscript · Fix skill
Root HTML has an H1 and readable text without JavaScript SHOULD N/A
Goal: Put an H1 and enough visible text in the raw root HTML that a non-JS agent can read the page.
Result: Not applicable (no h1 in raw HTML; visible text 4477 chars (min 200))
Resources: llmstxt.org · Fix skill
Per-section llms.txt files resolve under content subdirectories MAY BROKEN
Goal: Serve a scoped llms.txt inside each major content section.
Result: Present but broken (https://redocly.com/blog/llms.txt -> 200)
Fix: Serve a scoped `llms.txt` inside each major content section linked from your root index (for example `/docs/llms.txt`). A section-scoped index lets an agent working inside that section orient itself without re-reading the whole site index.
Resources: llmstxt.org · Fix skill
llms.txt links resolve SHOULD PASS
Goal: Make every markdown href in /llms.txt fetchable.
Result: Verified (https://redocly.com/blog/api-first.md -> 200)
Resources: llmstxt.org · Fix skill
-
C3
partial
Bot & crawl policy
2 / 3 checks pass
AI user-fetch User-Agent can reach the homepage SHOULD PASS
Goal: Let on-demand user-fetchers GET / with Accept */* and receive 2xx, not a challenge page.
Result: Verified (https://redocly.com/ -> 200)
Resources: OpenAI user-fetchers · Fix skill
robots.txt declares AI-crawler rules (RFC 9309) SHOULD PASS
Goal: State your AI-crawler policy in robots.txt with explicit User-agent rules.
Result: Verified (https://redocly.com/robots.txt -> 200)
robots.txt declares Content-Signal AI-usage preferences SHOULD BROKEN
Goal: Declare Content-Signal AI-usage preferences in robots.txt.
Result: Present but broken (https://redocly.com/robots.txt -> 200 (body no match /^\s*Content-Signal:\s*(ai-train|search|ai-input)/))
Fix: Add `Content-Signal` directives to `robots.txt` (contentsignals.org): `ai-train`, `search`, and `ai-input` set to `yes` or `no`. They express usage preferences at a finer grain than a blanket allow/deny.
Resources: contentsignals.org · Fix skill
Web Bot Auth signature directory present (informational) MAY N/A
Goal: Publish an HTTP Message Signatures directory if your site sends signed bot traffic.
Result: Not implemented, optional (https://redocly.com/.well-known/http-message-signatures-directory -> 404 (status 404 not in [200]))
Resources: Web Bot Auth draft · Fix skill
-
C4
fail
API
0 / 3 checks pass
An OpenAPI description is published MUST MISSING
Goal: Publish an OpenAPI description so non-MCP agents can call your HTTP API.
Result: Not found (https://redocly.com/openapi.json -> 404 (status 404 not in [200]))
Fix: If your service exposes an HTTP/REST API (separate from any MCP endpoint), publish an OpenAPI 3.1 description of it at `/openapi.json` (or `/openapi.yaml`, or `/.well-known/openapi.json`). Non-MCP agents use it to discover endpoints, parameters, and response shapes, and to generate typed clients. A service whose only machine surface is MCP has no REST API to describe here.
Resources: OpenAPI 3.1 · Fix skill
Referenced JSON Schemas resolve as application/schema+json MAY N/A
Goal: Serve the JSON Schemas your API references so agents can validate payloads pre-flight.
Result: Not applicable (no JSON Schema references detected)
Resources: JSON Schema · Fix skill
/.well-known/api-catalog published (RFC 9727) MAY N/A
Goal: Serve an RFC 9727 api-catalog linkset indexing your API descriptions.
Result: Not implemented, optional (https://redocly.com/.well-known/api-catalog -> 404 (status 404 not in [200]))
API responses advertise rate-limit headers SHOULD MISSING
Goal: Advertise remaining quota on API responses so agents can back off instead of retrying blindly.
Result: Not found (https://redocly.com/anc-web-audit-no-such-api -> 404 (no rate-limit header))
Fix: Send IETF RateLimit headers (`RateLimit-Limit`, `RateLimit-Remaining`, `RateLimit-Reset`) or the common `X-RateLimit-*` aliases on API responses. A 429 should also carry `Retry-After`. Without them an agent has no budget and will retry until it is locked out.
Resources: IETF RateLimit header draft · Fix skill
API client errors return JSON, not HTML SHOULD BROKEN
Goal: Return a JSON error body on client-error API responses so agents can parse the failure.
Result: Present but broken (https://redocly.com/anc-web-audit-no-such-api -> 404 (HTML error body))
Fix: On a client-error API response (4xx), return `Content-Type: application/json` and a JSON object (for example `{ "error": { "code": "not_found", "message": "..." } }`), not an HTML error page. Agents cannot recover from a soft-HTML 404. The audit probes a documented OpenAPI 4xx GET when one exists, otherwise `GET /anc-web-audit-no-such-api`.
Resources: RFC 9457 (problem+json) · Fix skill
-
C5
partial
MCP
18 / 19 checks pass
initialize handshake returns serverInfo + protocolVersion MUST PASS
Goal: Answer JSON-RPC initialize with serverInfo and protocolVersion so clients can begin a session.
Result: Verified (serverInfo Docs MCP server, protocol 2025-06-18)
Resources: MCP lifecycle · Fix skill
server/discover answers with server identity on the modern lane SHOULD PASS
Goal: Answer server/discover with supported versions, capabilities, and server identity.
Result: Verified (supports 2026-07-28, serverInfo Docs MCP server)
Resources: MCP lifecycle (2026-07-28) · Fix skill
unknown JSON-RPC method returns -32601 SHOULD PASS
Goal: Reject unknown JSON-RPC methods with error -32601 instead of a hang or 500.
Result: Verified (error code -32601)
Resources: JSON-RPC 2.0 · Fix skill
a non-JSON body draws -32700 (or a typed HTTP 400/415 refusal) SHOULD BROKEN
Goal: Refuse an unparseable request body with a parse-error envelope or a typed HTTP refusal.
Result: Present but broken (https://redocly.com/mcp -> 500 (no parseable JSON-RPC response))
Fix: Answer a `POST` whose body is not valid JSON with the JSON-RPC parse-error envelope (`error.code: -32700`, `id: null`); delivering it at HTTP `400` is fine. A bare HTTP `400` or `415` with no envelope also conforms as a typed refusal. What fails the check: a `200` with garbage, a hang, or any other bare status (a bare `404` reads as a dead endpoint, not a refusal).
Resources: JSON-RPC 2.0 · Fix skill
resources/list returns at least one resource when advertised SHOULD PASS
Goal: Honor capabilities.resources with a non-empty resources/list result.
Result: Verified (https://redocly.com/mcp -> 200)
Resources: MCP resources · Fix skill
tools/list returns a tools array with input schemas MUST PASS
Goal: Return tools/list entries with name, description, and a JSON inputSchema.
Result: Verified (2 tools, 2 with input schema)
a batch carrying a modern-envelope request is rejected -32600 SHOULD PASS
Goal: Refuse JSON array batches that carry modern-era envelopes with -32600.
Result: Verified (error code -32600)
Resources: JSON-RPC 2.0 · MCP transports (2026-07-28) · Fix skill
header-routed tools/list (2026-07-28) returns tools without initialize MUST PASS
Goal: Answer a modern header-routed tools/list without requiring an initialize handshake.
Result: Verified (2 tools, 2 with input schema)
Resources: MCP lifecycle (2026-07-28) · MCP tools (2026-07-28) · Fix skill
initialize advertises capabilities (tools / resources / prompts) SHOULD PASS
Goal: Advertise the capability groups your MCP server implements in the initialize result.
Result: Verified (serverInfo Docs MCP server, protocol 2025-06-18)
Resources: MCP lifecycle · Fix skill
an Mcp-Method header disagreeing with the body method draws -32020 SHOULD PASS
Goal: Validate the SEP-2243 header mirror between Mcp-Method and the body method.
Result: Verified (error code -32020)
Resources: MCP lifecycle (2026-07-28) · Fix skill
tools/call with an unknown tool name returns -32602 SHOULD PASS
Goal: Reject an unknown tool name with -32602 instead of a hang, a 500, or a fake result.
Result: Verified (error code -32602)
Resources: MCP tools · JSON-RPC 2.0 · Fix skill
an unknown method on the modern lane returns -32601 SHOULD PASS
Goal: Reject unknown header-routed methods with -32601 on the 2026-07-28 lane.
Result: Verified (error code -32601)
Resources: JSON-RPC 2.0 · MCP lifecycle (2026-07-28) · Fix skill
modern resources/read with an unknown URI returns -32602 SHOULD PASS
Goal: Answer an unknown resource URI with the typed miss code, not a hang or a fake result.
Result: Verified (error code -32602)
Resources: MCP resources (2026-07-28) · JSON-RPC 2.0 · Fix skill
an unsupported protocol version is rejected -32022 with data.supported SHOULD PASS
Goal: Refuse unsupported protocol version claims with -32022 and advertise the served revisions.
Result: Verified (error code -32022)
Resources: MCP lifecycle (2026-07-28) · Fix skill
_meta missing clientCapabilities is rejected (-32602 or -32600) SHOULD PASS
Goal: Enforce the mandatory clientCapabilities key on every modern request.
Result: Verified (error code -32602)
Resources: MCP lifecycle (2026-07-28) · Fix skill
a JSON-only Accept is answered without SSE framing SHOULD PASS
Goal: Serve a single application/json response to a client whose Accept names only application/json.
Result: Verified (https://redocly.com/mcp -> 406)
Resources: MCP transports · RFC 9110 section 12.5.1 (Accept) · Fix skill
GET on the MCP endpoint answers fast (not a held-open hang) SHOULD PASS
Goal: Answer GET on the MCP endpoint fast (a fast-fail status or a documented surface), never a held-open hang.
Result: Verified (https://redocly.com/mcp -> 405)
Resources: MCP transports · Fix skill
A .well-known MCP server card is published (SEP-1649) SHOULD PASS
Goal: Publish an MCP server card at the canonical SEP-1649 path.
Result: Verified (https://redocly.com/.well-known/mcp/server-card.json -> 200)
Root HTML exposes WebMCP browser tools MAY N/A
Goal: Expose page tools to browser agents via WebMCP.
Result: Not implemented, optional (https://redocly.com/ -> 200 (no WebMCP markers in root HTML))
Resources: WebMCP spec · Fix skill
an unsatisfiable Accept draws a 406 rather than an unasked-for type SHOULD PASS
Goal: Refuse an Accept you cannot satisfy with 406, never a 200 carrying a type the client did not request.
Result: Verified (https://redocly.com/mcp -> 406)
Resources: RFC 9110 section 15.5.7 (406 Not Acceptable) · MCP transports · Fix skill
CORS preflight (OPTIONS) succeeds with Access-Control-Allow-* headers SHOULD N/A
Goal: Serve one consistent CORS posture on the MCP endpoint, full preflight support or none.
Result: Deliberate posture, not scored (no Allow-Origin on the preflight or the POST: consistent no-CORS posture)
Resources: MDN CORS preflight · Fix skill
POST response carries Access-Control-Allow-Origin SHOULD N/A
Goal: Mirror the declared CORS posture on the actual MCP POST response.
Result: Deliberate posture, not scored (no Allow-Origin on the preflight or the POST: consistent no-CORS posture)
Legacy MCP card paths redirect to the canonical card MAY N/A
Goal: Point every legacy MCP card path at the canonical card instead of serving its own copy.
Result: Not implemented, optional (https://redocly.com/.well-known/mcp -> 404 (404 alias not published))
A human/agent usage doc for the server resolves MAY N/A
Goal: Publish a one-fetch markdown usage doc for your MCP server.
Result: Not implemented, optional (https://redocly.com/mcp-skill.md -> 404 (status 404 not in [200]))
Resources: anc.dev example · Fix skill
-
C6
pass
Agent discovery & auth
2 / 2 checks pass
OAuth/OIDC discovery metadata published MAY N/A
Goal: Publish OAuth/OIDC discovery metadata if agents authenticate to your service.
Result: Not applicable (no auth surface detected)
OAuth Protected Resource Metadata published (RFC 9728) MAY N/A
Goal: Publish RFC 9728 protected-resource metadata for your authenticated MCP server.
Result: Not applicable (MCP endpoint does not challenge for auth)
Agent auth/registration metadata doc published MAY N/A
Goal: Publish an auth.md telling agents how to obtain credentials.
Result: Not applicable (no auth surface detected)
Resources: anc.dev example · Fix skill
A2A Agent Card published for agent-to-agent discovery MAY PASS
Goal: Publish an A2A Agent Card for agent-to-agent discovery.
Result: Verified (https://redocly.com/.well-known/agent-card.json -> 200)
Resources: A2A protocol · Fix skill
Agent-skills discovery index published MAY PASS
Goal: Publish an agent-skills discovery index so agents can enumerate your skills.
Result: Verified (https://redocly.com/.well-known/agent-skills/index.json -> 200)
Resources: Agent Skills Discovery · Fix skill
/.well-known/ai-catalog.json published (ARD) MAY N/A
Goal: Publish an Agentic Resource Discovery catalog so agents can enumerate your AI artifacts.
Result: Not implemented, optional (https://redocly.com/.well-known/ai-catalog.json -> 404 (status 404 not in [200]))
Resources: AI Catalog · Fix skill
This scorecard reflects the target's public agent-facing surface at audit time. Re-audit from the control above to refresh it, or call the audit_website MCP tool.